Skip to content

Commit d1098b5

Browse files
bohdanyurov-glbohdanyurov-gl
committed
Fixes #180: Add tests for beta submodules/examples
#180 Added tests for the beta private cluster.
1 parent 3c7f472 commit d1098b5

File tree

15 files changed

+595
-19
lines changed

15 files changed

+595
-19
lines changed

‎.kitchen.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,19 @@ suites:
155155
systems:
156156
- name: workload_metadata_config
157157
backend: local
158+
- name: "beta_cluster"
159+
driver:
160+
root_module_directory: test/fixtures/beta_cluster
161+
verifier:
162+
systems:
163+
- name: gcloud
164+
backend: local
165+
controls:
166+
- gcloud
167+
- name: gcp
168+
backend: gcp
169+
controls:
170+
- gcp
158171
- name: "deploy_service"
159172
driver:
160173
root_module_directory: test/fixtures/deploy_service

‎build/int.cloudbuild.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,26 @@ steps:
244244
- verify workload-metadata-config-local
245245
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
246246
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy workload-metadata-config-local']
247+
- id: create beta-cluster-local
248+
waitFor:
249+
- prepare
250+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
251+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do create beta-cluster-local']
252+
- id: converge beta-cluster-local
253+
waitFor:
254+
- create beta-cluster-local
255+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
256+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge beta-cluster-local']
257+
- id: verify beta-cluster-local
258+
waitFor:
259+
- converge beta-cluster-local
260+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
261+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify beta-cluster-local']
262+
#- id: destroy beta-cluster-local
263+
# waitFor:
264+
# - verify beta-cluster-local
265+
# name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
266+
# args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy beta-cluster-local']
247267
- id: create deploy-service-local
248268
waitFor:
249269
- prepare

‎examples/simple_regional_beta/README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,17 +10,22 @@ This example illustrates how to create a simple cluster with beta features.
1010
| cloudrun | Boolean to enable / disable CloudRun | string | `"true"` | no |
1111
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
1212
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | string | n/a | yes |
13+
| database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key_name is the name of a CloudKMS key. | object | `<list>` | no |
14+
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | string | `"false"` | no |
1315
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
1416
| ip\_range\_services | The secondary ip range to use for pods | string | n/a | yes |
1517
| istio | Boolean to enable / disable Istio | string | `"true"` | no |
1618
| network | The VPC network to host the cluster in | string | n/a | yes |
1719
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | string | `"SECURE"` | no |
1820
| node\_pools | List of maps containing node pools | list(map(string)) | `<list>` | no |
21+
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list | `<list>` | no |
1922
| project\_id | The project ID to host the cluster in | string | n/a | yes |
2023
| region | The region to host the cluster in | string | n/a | yes |
24+
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
2125
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
2226
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` and `node_version` = `1.12.7-gke.17` or later to use it). | bool | `"false"` | no |
2327
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes |
28+
| zones | The zones to host the cluster in (optional if regional cluster / required if zonal) | list(string) | `<list>` | no |
2429

2530
## Outputs
2631

‎examples/simple_regional_beta/main.tf

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -24,23 +24,27 @@ provider "google-beta" {
2424
}
2525

2626
module "gke" {
27-
source = "../../modules/beta-public-cluster/"
28-
project_id = var.project_id
29-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
30-
regional = true
31-
region = var.region
32-
network = var.network
33-
subnetwork = var.subnetwork
34-
ip_range_pods = var.ip_range_pods
35-
ip_range_services = var.ip_range_services
36-
create_service_account = false
37-
service_account = var.compute_engine_service_account
38-
istio = var.istio
39-
cloudrun = var.cloudrun
40-
node_metadata = var.node_metadata
41-
sandbox_enabled = var.sandbox_enabled
42-
remove_default_node_pool = var.remove_default_node_pool
43-
node_pools = var.node_pools
27+
source = "../../modules/beta-public-cluster/"
28+
project_id = var.project_id
29+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
30+
regional = var.regional
31+
region = var.region
32+
zones = var.zones
33+
network = var.network
34+
subnetwork = var.subnetwork
35+
ip_range_pods = var.ip_range_pods
36+
ip_range_services = var.ip_range_services
37+
create_service_account = var.compute_engine_service_account == "create"
38+
service_account = var.compute_engine_service_account
39+
istio = var.istio
40+
cloudrun = var.cloudrun
41+
node_metadata = var.node_metadata
42+
sandbox_enabled = var.sandbox_enabled
43+
remove_default_node_pool = var.remove_default_node_pool
44+
node_pools = var.node_pools
45+
database_encryption = var.database_encryption
46+
enable_binary_authorization = var.enable_binary_authorization
47+
pod_security_policy_config = var.pod_security_policy_config
4448
}
4549

4650
data "google_client_config" "default" {

‎examples/simple_regional_beta/variables.tf

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,3 +85,36 @@ variable "node_pools" {
8585
},
8686
]
8787
}
88+
89+
variable "database_encryption" {
90+
description = "Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \"ENCRYPTED\"; \"DECRYPTED\". key_name is the name of a CloudKMS key."
91+
type = list(object({ state = string, key_name = string }))
92+
default = [{
93+
state = "DECRYPTED"
94+
key_name = ""
95+
}]
96+
}
97+
98+
variable "enable_binary_authorization" {
99+
description = "Enable BinAuthZ Admission controller"
100+
default = false
101+
}
102+
103+
variable "pod_security_policy_config" {
104+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
105+
default = [{
106+
"enabled" = false
107+
}]
108+
}
109+
110+
variable "zones" {
111+
type = list(string)
112+
description = "The zones to host the cluster in (optional if regional cluster / required if zonal)"
113+
default = []
114+
}
115+
116+
variable "regional" {
117+
type = bool
118+
description = "Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!)"
119+
default = true
120+
}

‎test/ci/beta-cluster.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
3+
platform: linux
4+
5+
inputs:
6+
- name: pull-request
7+
path: terraform-google-kubernetes-engine
8+
9+
run:
10+
path: make
11+
args: ['test_integration']
12+
dir: terraform-google-kubernetes-engine
13+
14+
params:
15+
SUITE: "beta-cluster-local"
16+
COMPUTE_ENGINE_SERVICE_ACCOUNT: ""
17+
REGION: "us-east4"
18+
ZONES: '["us-east4-a", "us-east4-b", "us-east4-c"]'

‎test/fixtures/beta_cluster/main.tf

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
18+
provider "google" {
19+
version = "~> 2.18.0"
20+
project = var.project_id
21+
region = var.region
22+
}
23+
24+
provider "google-beta" {
25+
version = "~> 2.18.0"
26+
project = var.project_id
27+
region = var.region
28+
}
29+
30+
locals {
31+
name = "beta-cluster-${random_string.suffix.result}"
32+
}
33+
34+
resource "google_kms_key_ring" "db" {
35+
location = var.region
36+
name = "${local.name}-db"
37+
}
38+
39+
resource "google_kms_crypto_key" "db" {
40+
name = local.name
41+
key_ring = google_kms_key_ring.db.self_link
42+
}
43+
44+
module "this" {
45+
source = "../../../examples/simple_regional_beta"
46+
47+
cluster_name_suffix = "-${random_string.suffix.result}"
48+
project_id = var.project_id
49+
regional = false
50+
region = var.region
51+
zones = slice(var.zones, 0, 1)
52+
network = google_compute_network.main.name
53+
subnetwork = google_compute_subnetwork.main.name
54+
ip_range_pods = google_compute_subnetwork.main.secondary_ip_range[0].range_name
55+
ip_range_services = google_compute_subnetwork.main.secondary_ip_range[1].range_name
56+
compute_engine_service_account = "create"
57+
58+
// Beta features
59+
istio = true
60+
61+
database_encryption = [{
62+
state = "ENCRYPTED"
63+
key_name = google_kms_crypto_key.db.self_link
64+
}]
65+
66+
cloudrun = true
67+
68+
enable_binary_authorization = true
69+
70+
pod_security_policy_config = [{
71+
enabled = true
72+
}]
73+
74+
node_metadata = "EXPOSE"
75+
}
76+
77+
data "google_client_config" "default" {
78+
}

‎test/fixtures/beta_cluster/network.tf

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
resource "random_string" "suffix" {
18+
length = 4
19+
special = false
20+
upper = false
21+
}
22+
23+
resource "google_compute_network" "main" {
24+
name = "cft-gke-test-${random_string.suffix.result}"
25+
auto_create_subnetworks = false
26+
}
27+
28+
resource "google_compute_subnetwork" "main" {
29+
name = "cft-gke-test-${random_string.suffix.result}"
30+
ip_cidr_range = "10.0.0.0/17"
31+
region = var.region
32+
network = google_compute_network.main.self_link
33+
34+
secondary_ip_range {
35+
range_name = "cft-gke-test-pods-${random_string.suffix.result}"
36+
ip_cidr_range = "192.168.0.0/18"
37+
}
38+
39+
secondary_ip_range {
40+
range_name = "cft-gke-test-services-${random_string.suffix.result}"
41+
ip_cidr_range = "192.168.64.0/18"
42+
}
43+
}
44+

‎test/fixtures/beta_cluster/outputs.tf

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "project_id" {
18+
value = var.project_id
19+
}
20+
21+
output "region" {
22+
value = module.this.region
23+
}
24+
25+
output "cluster_name" {
26+
description = "Cluster name"
27+
value = module.this.cluster_name
28+
}
29+
30+
output "network" {
31+
value = google_compute_network.main.name
32+
}
33+
34+
output "subnetwork" {
35+
value = google_compute_subnetwork.main.name
36+
}
37+
38+
output "location" {
39+
value = module.this.location
40+
}
41+
42+
output "ip_range_pods" {
43+
description = "The secondary IP range used for pods"
44+
value = google_compute_subnetwork.main.secondary_ip_range[0].range_name
45+
}
46+
47+
output "ip_range_services" {
48+
description = "The secondary IP range used for services"
49+
value = google_compute_subnetwork.main.secondary_ip_range[1].range_name
50+
}
51+
52+
output "zones" {
53+
description = "List of zones in which the cluster resides"
54+
value = module.this.zones
55+
}
56+
57+
output "master_kubernetes_version" {
58+
description = "The master Kubernetes version"
59+
value = module.this.master_kubernetes_version
60+
}
61+
62+
output "kubernetes_endpoint" {
63+
sensitive = true
64+
value = module.this.kubernetes_endpoint
65+
}
66+
67+
output "client_token" {
68+
sensitive = true
69+
value = base64encode(data.google_client_config.default.access_token)
70+
}
71+
72+
output "ca_certificate" {
73+
description = "The cluster CA certificate"
74+
value = module.this.ca_certificate
75+
}
76+
77+
output "service_account" {
78+
description = "The service account to default running nodes as if not overridden in `node_pools`."
79+
value = module.this.service_account
80+
}
81+
82+
output "database_encryption_key_name" {
83+
value = google_kms_crypto_key.db.self_link
84+
}

‎test/fixtures/beta_cluster/variables.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../deploy_service/variables.tf

0 commit comments

Comments
 (0)